.It Fl rc

.It Fl rc

Restart an existing jail.

Restart an existing jail.

The jail is first removed and then re-created, as if

The jail is first removed and then re-created, as if

.Dq Nm Fl r

.Dq Nm Fl r

were run in succession.

were run in succession.

.It Fl cm

.It Fl cm

Create a jail if it does not exist, or modify the jail if it does exist.

Create a jail if it does not exist, or modify the jail if it does exist.

parameter (or

parameter (or

.Va hostname )

.Va hostname )

and add all IP addresses returned by the resolver

and add all IP addresses returned by the resolver

This is equivalent to the

This is equivalent to the

.Va ip_hostname

.Va ip_hostname

parameter.

parameter.

file format, and need not be explicitly set when using the configuration

file format, and need not be explicitly set when using the configuration

file.

file.

.It Va path

.It Va path

.Nm

.Nm

or from

or from

.Xr jexec 8 ,

.Xr jexec 8 ,

are run from this directory.

are run from this directory.

.It Va ip4.addr

.It Va ip4.addr

If this is set, the jail is restricted to using only these addresses.

If this is set, the jail is restricted to using only these addresses.

Any attempts to use other addresses fail, and attempts to use wildcard

Any attempts to use other addresses fail, and attempts to use wildcard

addresses silently use the jailed address instead.

addresses silently use the jailed address instead.

assigned to itself.

assigned to itself.

.It Va ip4.saddrsel

.It Va ip4.saddrsel

A boolean option to change the formerly mentioned behaviour and disable

A boolean option to change the formerly mentioned behaviour and disable

IPv4 address of the jail.

IPv4 address of the jail.

Source address selection is enabled by default for all jails and the

Source address selection is enabled by default for all jails and the

.Va ip4.nosaddrsel

.Va ip4.nosaddrsel

parameter implies a value of

parameter implies a value of

.Dq new .

.Dq new .

.It Va ip6.addr , Va ip6.saddrsel , Va ip6

.It Va ip6.addr , Va ip6.saddrsel , Va ip6

.Va ip4.addr ,

.Va ip4.addr ,

.Va ip4.saddrsel

.Va ip4.saddrsel

and

and

.Va ip4

.Va ip4

above.

above.

.It vnet

.It vnet

with its own network interfaces, addresses, routing table, etc.

with its own network interfaces, addresses, routing table, etc.

The kernel must have been compiled with the

The kernel must have been compiled with the

.Sy VIMAGE option

.Sy VIMAGE option

.Dq new

.Dq new

to create a new network stack.

to create a new network stack.

.It Va host.hostname

.It Va host.hostname

Other similar parameters are

Other similar parameters are

.Va host.domainname ,

.Va host.domainname ,

.Va host.hostuuid

.Va host.hostuuid

within a jail would be able to communicate with (and potentially interfere

within a jail would be able to communicate with (and potentially interfere

with) processes outside of the jail, and in other jails.

with) processes outside of the jail, and in other jails.

.It Va allow.raw_sockets

.It Va allow.raw_sockets

Setting this parameter allows utilities like

Setting this parameter allows utilities like

.Xr ping 8

.Xr ping 8

and

and

.Xr traceroute 8

.Xr traceroute 8

If this is set, the source IP addresses are enforced to comply

If this is set, the source IP addresses are enforced to comply

with the IP address bound to the jail, regardless of whether or not

with the IP address bound to the jail, regardless of whether or not

the

the

for information on how to configure the ZFS filesystem to operate from

for information on how to configure the ZFS filesystem to operate from

within a jail.

within a jail.

.It Va allow.quotas

.It Va allow.quotas

This includes filesystems that the jail may share with other jails or

This includes filesystems that the jail may share with other jails or

with non-jailed parts of the system.

with non-jailed parts of the system.

.It Va allow.socket_af

.It Va allow.socket_af

There are pseudo-parameters that aren't passed to the kernel, but are

There are pseudo-parameters that aren't passed to the kernel, but are

used by

used by

.Nm

.Nm

when jails are created or removed.

when jails are created or removed.

The

The

.Va exec.*

.Va exec.*

command parameters are

command parameters are

.Xr sh 1

.Xr sh 1

They may be given multiple values, which run would the specified

They may be given multiple values, which run would the specified

commands in sequence.

commands in sequence.

All commands must succeed (return a zero exit status), or the jail will

All commands must succeed (return a zero exit status), or the jail will

The pseudo-parameters are:

The pseudo-parameters are:

.Bl -tag -width indent

.Bl -tag -width indent

.It Va exec.prestart

.It Va exec.prestart

.It Va exec.start

.It Va exec.start

A typical command to run is

A typical command to run is

.Dq sh /etc/rc .

.Dq sh /etc/rc .

.It Va command

.It Va command

A synonym for

A synonym for

.Va exec.start

.Va exec.start

Unlike other parameters whose value is a single string,

Unlike other parameters whose value is a single string,

.Va command

.Va command

uses the remainder of the

uses the remainder of the

.It Va exec.prestop

.It Va exec.prestop

Command(s) to run in the system environment before a jail is removed.

Command(s) to run in the system environment before a jail is removed.

.It Va exec.stop

.It Va exec.stop

and after any

and after any

.Va exec.prestop

.Va exec.prestop

commands have completed.

commands have completed.

The environment variables from the login class capability database for the

The environment variables from the login class capability database for the

target login are also set.

target login are also set.

.It Va exec.jail_user

.It Va exec.jail_user

The default is to run the commands as the current user.

The default is to run the commands as the current user.

.It Va exec.system_jail_user

.It Va exec.system_jail_user

This boolean option looks for the

This boolean option looks for the

.Va exec.jail_user

.Va exec.jail_user

in the system

in the system

.Xr passwd 5

.Xr passwd 5

.It Va exec.system_user

.It Va exec.system_user

The user to run commands as, when running in the system environment.

The user to run commands as, when running in the system environment.

The default is to run the commands as the current user.

The default is to run the commands as the current user.

.It Va exec.consolelog

.It Va exec.consolelog

A file to direct command output (stdout and stderr) to.

A file to direct command output (stdout and stderr) to.

.It Va exec.fib

.It Va exec.fib

.It Va stop.timeout

.It Va stop.timeout

after sending them a

after sending them a

.Dv SIGTERM

.Dv SIGTERM

signal (which happens after the

signal (which happens after the

.Va exec.stop

.Va exec.stop

commands have completed).

commands have completed).

will kill any remaining processes.

will kill any remaining processes.

If this is set to zero, no

If this is set to zero, no

.Dv SIGTERM

.Dv SIGTERM

The default is 10 seconds.

The default is 10 seconds.

.It Va interface

.It Va interface

.Va ( ip4.addr

.Va ( ip4.addr

and

and

.Va ip6.addr )

.Va ip6.addr )

to.

to.

An alias for each address will be added to the interface before the

An alias for each address will be added to the interface before the

.It Op Va ip4.addr

.It Op Va ip4.addr

In addition to the IP addresses that are passed to the kernel, and

In addition to the IP addresses that are passed to the kernel, and

interface and/or a netmask may also be specified, in the form

interface and/or a netmask may also be specified, in the form

.Va ( ip4.addr

.Va ( ip4.addr

or

or

.Va ip6.addr )

.Va ip6.addr )

This may affect default address selection for outgoing IPv4 connections

This may affect default address selection for outgoing IPv4 connections

The address first returned by the resolver for each address family

The address first returned by the resolver for each address family

will be used as primary address.

will be used as primary address.

.It Va mount

.It Va mount

filesystem on the chrooted /dev directory, and apply the ruleset in the

filesystem on the chrooted /dev directory, and apply the ruleset in the

.Va devfs_ruleset

.Va devfs_ruleset

parameter (or a default of ruleset 4: devfsrules_jail)

parameter (or a default of ruleset 4: devfsrules_jail)

.It Va allow.dying

.It Va allow.dying

Allow making changes to a

Allow making changes to a

.Va dying

.Va dying

.Pp

.Pp

The variable

The variable

.Va security.jail.max_af_ips

.Va security.jail.max_af_ips

The default is 255.

The default is 255.

.Pp

.Pp

Some MIB variables have per-jail settings.

Some MIB variables have per-jail settings.